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NATIONAL RECORDS OF SCOTLAND 
NATIONAL RECORDS OF SCOTLAND TERMS AND CONDITIONS 1 (NRSTC1) 
CONDITIONS OF CONTRACT FOR THE PURCHASE OF GOODS 


These Conditions may be varied only by the written agreement of the Purchaser. 
No terms or conditions put forward at any time by the Supplier shall form any part 
of the Contract unless specifically agreed in writing by the Purchaser. 
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1. DEFINITIONS 


In these Conditions: 


“Contract” means the contract between the Purchaser and the Supplier consisting of 
the Purchase Order, these Conditions and any other documents (or parts thereof) 
specified in the Purchase Order; 


“Data Controller”, “Data Processor”, “Data Subject” and “Data Subject Access Request’ 
have the meanings given in the Data Protection Laws; 


“Data Protection Laws” means any Law, statute, subordinate legislation regulation, 
order, mandatory guidance or code of practice, judgment ofa relevant court of Law, 
or directives or requirements of any regulatory body which relates to the protection of 
individuals with regard to the processing of Personal Data to which a Party is subject 
including the Data Protection Act 2018 and any statutory modification or re- 
enactment thereof and the UK GDPR; 


“Goods” means any such goods as are to be supplied to the Purchaser by the 
Supplier (or by any of the Supplier’s sub-contractors) pursuant to or in connection 
with this Contract; 


‘Good Industry Practice’ means standards, practices, methods and procedures 
conforming to legal and regulatory requirements and the degree of skill and care, 
diligence, prudence and foresight which would reasonably and ordinarily be expected 
froma skilled and experienced person or body engaged in a similar type of 
undertaking as the Supplier under the same or similar circumstances. 


“Information Commissioner” means the Commissioner as set out in Part 5 of the Data 
Protection Act 2018. 


“Intellectual Property Rights” means all copyright, patent, trademark, design right, 
database right and any other right in the nature of intellectual propertywhether or not 
registered, in any materials or works in whatever form (including but not limited to any 
materials stored in or made available by means of an information technology system andthe 
computer software relating thereto) which are created, produced or developedin connection 
with this Contractby or on behalf of theSupplier; 


“Law’ means: 

(a) any applicable statute or proclamation or any delegate or subordinate legislation; 
(b) any enforceable right forming part of retained EU Law within the meaning of the 
European Union (Withdrawal) Act 2018; 

(c) any applicable guidance, direction, determination, or regulations with which the 
Purchaser and/or the Service Provider is bound to comply; 

(d) any applicable judgment of a relevant court of Law which is a binding precedentin 
Scotland; and 

(e) and requirements of any regulatory body; 


in each case in force during the period of the Contract in Scotland. 


“Personal Data” has the meaning given in the Data Protection Laws; 


“Processing” has the meaning given in the Data Protection Laws and cognate 
expressions shall be construed accordingly; 


“Purchaser” means the Registrar General of Births, Deaths and Marriages for 
NRSTC1 V1.0 2021 2 
NRS Procurement 


2. 


2.1 


2.2 


2.3 


3.1 


3.2.1 


3.2.2 


Scotland; 


“Purchase Order” means the documentsetting out the Purchaser’s requirements for 
the Contract. 


“Schedule” means a schedule annexed to and forming part of these Conditions; 
“Supplier” means the person, firm or company to whom the Contract is issued; 


“Third country” means a country or territory outside the United Kingdom; 
and 


“UK GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the 
Council of 27th April 2016 on the protection of natural persons with regard to the processing 
of Personal Data and on the free movement of such data (General Data Protection 
Regulation) as it forms part of the Law of England and Wales, Scotland and Northern 
lreland by virtue of section 3 of the European Union (Withdrawal) Act 2018 and as amended 
by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU 
Exit) Regulations 2019. 


THE GOODS 


The Goods shall be to the reasonable satisfaction of the Purchaser and shall conform 
in all respects with any particulars specified in the Contract and in any variations 
thereto. 


The Goods shall conform in all respects with the requirements of any statutes, 
orders, regulations or bye-laws from time to time in force. 


The Goods shall be fit and sufficient for the purpose for which such goods are 
ordinarily used and for any particular purpose made known to the Supplier by the 
Purchaser and the Purchaser relies on the skill and judgement of the Supplier in 
the supply of the Goods and the execution of the Contract. 


THE PRICE 


The price of the goods shall be as stated in the Contract and no increase will be 


accepted by the Purchaser unless agreed by the Purchaser in writing before the 
execution of the Contract. 


Unless otherwise agreed in writing by the Purchaser, the Supplier shall render a 
separate invoice in respect of each consignment delivered under the Contract. 
Payment shall be due 30 days after receipt of the Goods or the correct invoice 
therefor, whichever is the later. 


In this Condition 3, ‘invoice’ includes an electronic invoice meeting all the 
requirements set out in regulation 70A of the Public Contracts (Scotland) Regulations 
2015 or regulation 44A of the Concession Contracts (Scotland) Regulations 2016. 


3.3 Value Added Tax, where applicable, shall be shown separately on all invoices as a 


3.4 


strictly net extra charge. 


Notwithstanding Condition 19 (Assignation and sub-contracting) of this Contractthe 
Supplier may assign to another person (an “assignee”) the right to receive payment of 
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4.1 


4.2 


4.3 


4.4 


4.5 


4.6 


4.7 


4.8 


4.9 
4.10 


4.11 


the Price or any part thereof due to the Supplier under this Contract subject to (i) 
deduction of sums in respect of which the Purchaser exercises the right of recovery 
under Condition 18 (Recovery of sums due) of this Contract and (ii) all the related 
rights of the Purchaser under this Contract in relation to the recovery of sums due but 
unpaid. The Supplier shall notify or procure that any assignee notifies the Purchaser 
of any variations to the arrangements for payment of the Price or for handling 
invoices, in each case in good time to enable the Purchaser to redirect 

payments or invoices accordingly. In the absence of such notification the Purchaser 
shall be under no obligation to vary its arrangements for payment of the Price or for 
handling invoices. 


SECURITY AND ACCESS TO THE PURCHASER’S PREMISES 


Any access to, or occupation of, the Purchasers premises which the Purchaser may 
grant the Supplier from time to time is on a non-exclusive licence basis free of charge. 
The Supplier must use the Purchaser’s premises solely for the purpose of performing 
its obligations under the Contract and must limit access to the Purchaser’s premises to 
such individuals as are necessary for that purpose. 


The Supplier must comply with the Purchaser’s policies concerning Baseline Personnel 
Security Standard checks and such modifications to those policies or replacement 
policies as are notified to the Supplier from time to time. 


The Supplier must notify the Purchaser of any matter or other change in 
circumstances which might adversely affect future Baseline Personnel Security 
Standard clearance. 


At the Purchaser’s written request, the Supplier must provide a list of the names 
and addresses of all persons who may require admission to the Purchasers 
premises in connection with the Contract, specifying the capacities in which they 
are concerned with the Contract and giving such other particulars as the 
Purchaser may reasonably request. 


The Supplier must ensure that any individual Supplier Representative entering the 
Purchaser’s premises has completed the process for obtaining Baseline Personnel 
Security Standard clearance. The Supplier acknowedges that the Purchaser has the 
right to deny entry to any individual that has not completed the process for obtaining 
Baseline Personnel Security Standard clearance. 


In accordance wih the Purchaser’s policies concerning visitor access, entry to the 
Purchaser’s premises may be granted to individual Supplier Representatives for the 
purposes of meetings, notwithstanding thatthe process for obtaining Baseline 
Personnel Security Standard clearance has not commenced or completed. 


The Purchaser may, by notice to the Supplier, refuse to admit onto, or withdraw 
permission to remain on, the Purchaser’s premises any Supplier Representative 
whose admission or continued presence would, in the opinion of the Purchaser acting 
reasonably, be undesirable. 


The Purchaser must provide advice and assistance acting reasonably to the Supplier 
to facilitate the Supplier’s compliance with this Condition. 


All decisions of the Purchaser under this Condition are final and conclusive. 


Breach of this Condition 4 by the Supplier is a material breach for the 
purposes of Condition 17.2 (Termination). 


If cyber security requirements apply to this Contract: 


NRSTC1 V1.0 2021 4 
NRS Procurement 


4.11.1 Then these are set out in a Schedule Part 2 (Cyber Security 
Requirements) to this Contract; and 
4.11.2 in that case the Supplier shall comply with the provisions of Schedule Part 2 
(Cyber Security Requirements) 


and this Condition 4 shall not apply where the Contract does not include a Schedule Part 2 
(Cyber Security Requirements). 


In this Condition 4, “Baseline Personnel Security Standard” means the pre- employment 
controls for all civil servants, members of the Armed Forces, temporary staff and government 
contractors generally. 


“Supplier Representatives” means all persons engaged by the Supplier in the performance of 
its obligations under the Contract including: 


" its employees and workers (including persons employed by a third party 
but working for and under the control of the Supplier); 

g its agents, suppliers and carriers; and 

7 any sub-contractors of the Supplier (whether approved under Condition 19 


(Assignation and sub-contracting) or otherwise). 


5i DELIVERY 


5.1 The Goods shall be delivered to the place named in the Contract. Any access to 
premises and any labour and equipmentthat may be provided by the Purchaser in 
connection with delivery shall be provided without acceptance by the Purchaser of any 
liability whatsoever and the Supplier shall indemnify the Purchaser and the Crown in 
respect of any actions, suits, claims, demands losses, charges, costs and expenses 
which the Purchaser or the Crown may suffer or incur as a result of or in connection 
with any damage or injury (whether fatal or otherwise) occurring in the course of 
delivery or installation to the extent that any such damage or injury is attributable to 
any act or omission of the Supplier or any of his 
sub-contractors. 


5.2 Where any access to the premises is necessary in connection with delivery or 
installation the Supplier and the Suppliers sub-contractors shall at all times comply 
with the reasonable requirements of the Purchaser’s Head of Security. 


5.3 The time of delivery shall be of the essence and failure to deliver within the time 
promised or specified shall enable the Purchaser (at the Purchaser's option) to 
release themselves from any obligation to accept and pay for the Goods and/or to 
cancel all or part of the Contract therefor, in either case without prejudice to the 
Purchaser’s other rights and remedies. 


6. PROPERTY AND RISK 


Property and risk in the Goods shall without prejudice to any of the rights or remedies of the 
Purchaser (including the Purchaser’s rights and remedies under Condition 8 hereof) pass to 
the Purchaser at the time of delivery. 


7. DAMAGE IN TRANSIT 


On dispatch of any consignment of the Goods the Supplier shall send to the Purchaser at the 
address for delivery of the Goods an advice note specifying the means of transport, the place 
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and date of dispatch, the number of packages and their weight and volume. The Supplier shall 
free of charge and as quickly as possible either repair or replace (as the Purchaser shall elect) 
such of the Goods as may either be damaged in transit or having been placed in transit fail to 
be delivered to the Purchaser provided that: 


(a) in the case of damage to such Goods in transit the Purchaser shall within 30 
days of delivery give notice to the Supplier that the Goods have been 
damaged; 


(b) in the case of non-delivery the Purchaser shall (provided that the Purchaser 
has been advised of the dispatch of the Goods) within ten days of the notified 
date of delivery give notice to the Supplier that the Goods have not been 
delivered. 


8. INSPECTION, REJECTION AND GUARANTEE 


8.1 The Supplier shall permit the Purchaser or the Purchaser’s authorised representatives 
to make any inspections or tests they may reasonably require and the Supplier shall 
afford all reasonable facilities and assistance free of charge at the Supplier’s premises. 
No failure to make complaint atthe time of such inspection or tests and no approval 
given during or after such tests or inspections shall constitute a waiver by the 
Purchaser of any rights or remedies in respect of the Goods. 


8.2 The Purchaser may by written notice to the Supplier reject any of the Goods which fail 
to meet the requirements specified in the contract. Such notice shall be given within a 
reasonable time after delivery to the Purchaser of Goods concerned. If the Purchaser 
shall reject any of the Goods pursuant to this Condition the Purchaser shall be entitled 
(without prejudice to the Purchaser’s other rights and remedies) either: 


(a) to have the Goods concerned as quickly as possible either repaired by the 
Supplier or (as the Purchaser shall elect) replaced by the Supplier with 
Goods which comply in all respects with the requirements specified herein; 
or 


(b) to obtain a refund from the Supplier in respect of the Goods 
concerned. 


8.3 The guarantee period applicable to the Goods shall be 12 months from putting into 
service or 18 months from delivery, whichever shall be the shorter (subject to any 
alternative guarantee arrangements agreed in writing between the Purchaser and the 
Supplier). If the Purchaser shall within such guarantee period or within 30 days 
thereafter give notice in writing to the Supplier of any defect in any of the Goods as 
may have arisen during such guarantee period under proper and normal use the 
Supplier shall (without prejudice to any other rights and remedies which the 
Purchaser may have) as quickly as possible remedy such defects (whether by repair 
or replacement as the Purchaser shall elect) without cost to the Purchaser. 


8.4 Any Goods rejected or returned by the Purchaser as describedin paragraphs 8.2 or 
8.3 shall be returned to the Supplier at the Suppliers risk and expense. 


9. LABELLING AND PACKAGING 


9.1 The Goods shall be packed and marked in a proper manner and in accordance with 
the Purchaser’s instructions and any statutory requirements and any requirements of 
the carriers. In particular the Goods shall be marked with the Purchase Order 
Number, the net, gross and tare weights, the name of the contents shall be clearly 
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marked on each container and all containers of hazardous goods (and all documents 
relating thereto) shall bear prominent and adequate warnings. The Supplier shall 
indemnify the Purchaser and the Crown against all actions, suits, claims. demands, 
losses, charges, costs and expenses which the Purchaser or the Crown may suffer or 
incur as a result of or in connection with any breach of this Condition. 


9.2 All packaging materials will be considered non-returnable and will be destroyed 
unless the Supplier's advice note states that such materials will be charged for unless 
returned. The Purchaser accepts no liability in respect of the non-arrival at the 
Supplier's premises of empty packages returned by the Purchaser unless the Supplier 
shall within 10 days of receiving notice from the Purchaser that the packages have 
been dispatched notify the Purchaser of such non-arrival. 


9.3 The Supplier represents and warrants that the maximum use has been made of 
recycled materials in the manufacture of crates, pallets, boxes, cartons, cushioning 
and other forms of packing, where these fulfil other packing specifications. 


10. | CORRUPT GIFTS OR PAYMENTS 


The Supplier shall not offer or give, or agree to give, to any employee or representative of 
the Purchaser any gift or consideration of any kind as an inducement or reward for doing or 
refraining from doing or for having done or refrained from doing, any act in relation to the 
obtaining or execution of this or any other contract with the Purchaser or for showing or 
refraining from showing favour or disfavour to any person in relation to this or any such 
Contract. The attention of the Supplier is drawn to the criminal offences created by the 
Bribery Act 2010. 


11. INTELLECTUAL PROPERTY RIGHTS 


11.1 All Intellectual Property Rights in any material including but not limited to reports, 
guidance, specification, instructions, toolkits, plans, data, drawings, databases, 
patents, patterns, models, designs which are created or developed by the Supplier 
on behalf of the Purchaser for use, or intended use, in relation to the performance by 
the Supplier of its obligations under the Contract are hereby assigned to and shall 
vest in the Crown absolutely. 


11.2 Except as may expressly be provided for in the Contract, neither party 
acquires any interest in or license to use the other party’s Intellectual Property Rights 
owned or developed prior to or independently of the Contract. 


11.3 The Supplier must not infringe any Intellectual Property Rights of any third party in 
performing its obligations under the Contract. The Supplier shall indemnify the 
Purchaser against all actions, claims, demands, losses, charges, costs and 
expenses which the Purchaser may suffer or incur as a result of or in connection with 
any breach of this Condition 11.3. 


11.4 The provisions of this Condition 11 shall apply during the continuance of this Contract 
and after its termination howsoever arising. 


12. HEALTH AND SAFETY 


The Supplier represents and warrants to the Purchaser that the Supplier is satisfied that all 
necessary tests and examinations have been made or will be made prior to delivery of the 
Goods to ensure that the Goods are designed and constructed so as to be safe and without 
risk to the health or safety of persons using the same, and that the Supplier has made 
available to the Purchaser adequate information about the use for which the Goods have been 
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designed and have been tested and about any conditions necessary to ensure that when put 
to use the goods will be safe and without risk to health. The Supplier shall indemnify the 
Purchaser and the Crown againstall actions, suits, claims, demands, losses, charges, costs 
and expenses which the Purchaser or the Crown may suffer or incur as a result of or in 
connection with any breach of this Condition. 


13. INDEMNITY AND INSURANCE 


13.1 Without prejudice to any rights or remedies of the Purchaser (including the 
Purchaser’s rights and remedies under Condition 8 hereof) the Supplier shall 
indemnify the Purchaser and the Crown against all actions, suits, claims, demands, 
losses, charges, costs and expenses which the Purchaser or the Crown may suffer or 
incur as a result of or in connection with any damage to property or in respect of any 
injury (whether fatal or otherwise) to any person which may result directly or indirectly 
from any defect in the Goods or the negligent or wrongful act or omission of the 
Supplier. 


13.2 The Purchaser shall indemnify the Supplier in respect of all claims, proceedings, 
actions, damages, fines, costs, expenses or other liabilities which may arise out of, or 
in consequence of, a breach of the Data Protection Laws where the breach is the direct 
result of the Supplier acting in accordance with the Purchaser’s specific written 
instructions. This indemnity provision shall not apply if the Supplier- 


(a) acts onthe Purchaser’s specific written instructions but fails to notify the 
Purchaser in accordance with Condition 26.11 (c) (Data Protection) of this Contract; 


(b) fails to comply with any other obligation under the Contract. 


13.3 The Supplier shall effect with a reputable insurance company a policy or policies of 
insurance covering all the matters which are the subject of indemnities under these 
Conditions and shall at the request of the Purchaser 
produce the relevant policy or policies together with receipts or other evidence 
of payment of premiums, including the latest premium due thereunder. 


14. DISCRIMINATION 


The Supplier must not unlawfully discriminate against any person within the meaning of the 
Equality Act 2010 in its activities relating to the Contract or any other contract with the 
Purchaser. 


15. BLACKLISTING 


The Supplier must not commit any breach of the Employment Relations Act 1999 (Blacklists) 
Regulations 2010 or section 137 of the Trade Union and Labour Relations (Consolidation) Act 
1992, or commit any breach of the Data Protection Laws by unlawfully processing Personal Data 
in connection with any blacklisting activities. 

Breach of this Condition is a material default which shall entitle the Purchaserto terminate the 
Contract. 


16. OFFICIAL SECRETS ACTS, CONFIDENTIALITY, AND ACCESS TO 
GOVERNMENT INFORMATION 


16.1 The Supplier undertakes to abide and procure that the Supplier’s employees abide by 
the provisions of the Official Secrets Acts 1911-1989. 


16.2 The Supplier shall keep secret and not disclose and shall procure that the Suppliers 
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employees keep secret and do not disclose any information of a confidential nature 
obtained by the Supplier by reason of the Contract except information which is in the 
public domain otherwise than by reason of a breach of this provision. 


16.3 All information related to the Contract with the Supplier shall be treated as 
commercial in confidence by the parties except that: 


(a) The Supplier may disclose any information as required by Lawor judicial 
order to be disclosed. 


(b) The Purchaser may disclose any information as required by Lawor judicial 
order to be disclosed; further the Purchaser may disclose all information 
obtained by the Purchaser by virtue of the Contract to the Scottish or United 
Kingdom Parliament or any other department, office or agency of Her Majesty’s 
Government in Scotland or the United Kingdom, and their servants or agents. 
When disclosing such information to either the Scottish Parliament or the 
United Kingdom Parliament it is recognised and agreed by both parties that the 
Purchaser shall, if the Purchaser sees fit, disclose such information butis 
unable to impose any restrictions upon the information that the Purchaser 
provides to Members of the Scottish Parliament, (MSPs) or Members of the 
United Kingdom Parliament (MPs). Such disclosure shall not be treated as a 
breach of this Contract. 


16.4 The provisions of this Condition 16 shall apply during the continuance of the Contract 
and after its termination howsoever arising. 


16.5 The Parties acknowledge that, except for any Information which is exempt from disclosure 
in accordance wih the provisions of the FOISA, the content of the Contract is not 
confidential information and the Supplier hereby gives its consent for the Purchaser to 
publish the Contract in its entirety to the general public (but with any Information that is 
exempt from disclosure in accordance with the FOISA redacted) including any changes 
to the Contract agreed from time to time. 


17. TERMINATION 


17.1 Without prejudice to any other rights or remedies of the Purchaser under the Contract 
the Purchaser shall have the right to terminate the Contract by written notice to the 
Supplier or the appropriate trustee in bankruptcy or sequestration, receiver, liquidator 
or administrator: 


(a) where the Supplier is an individual and if a petition is presented for the 
Supplier’s bankruptcy or the sequestration of his estate or a criminal 
bankruptcy order is made against the Supplier, or the Supplier is apparently 
insolvent, or makes any composition or arrangement with or for the benefit of 
creditors, or makes any conveyance or assignment for the benefit of 
creditors, or ifan administrator or trustee is appointed to manage the 
Supplier’s affairs; or 


(b) where the Supplier is not an individual but is a firm or a number of persons 
acting together in any capacity, if any event in (a) or (c) of this Condition 
occurs in respect of the firm or any partner in the firm or any of those persons 
or a petition is presented for the Supplier to be wound up as an unregistered 
company; or 


(c) where the Supplier is a company, if the company passes a resolution for 
winding-up or dissolution (otherwise than for the purposes of and followed by 
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an amalgamation or reconstruction) or the court makes an administration 
order or a winding-up order, or the company makes a composition or 
arrangement with its creditors, or an administrator, administrative receiver, 
receiver or manager is appointed by a creditor or by the court, or possession is 
taken of any of its property under the terms of a floating charge. 


17.2 On the occurrence of any of the events describedin Condition 17.1 or, ifthe Supplier 
shall have committed a material breach of this Contract and (if such breach is 
capable of remedy) shall have failed to remedy such breach within 30 days of being 
required by the Purchaser in writing to do so or, where the Supplier is an individual if 
the Supplier shall die or be adjudged incapable of managing his or her affairs within 
the meaning of the Adults with Incapacity (Scotland) Act 2000 or the Mental Health 
(Care and Treatment) (Scotland) Act 2003, the Purchaser shall be entitled to 
terminate this Contract by notice to the Supplier with immediate effect. 


17.3 The Purchaser may terminate the Contract in the event that: 


(a) the Contract has been subject to substantial modification which would have 
required a new procurement procedure in accordance with regulation 72(9) 
(modification of contracts during their term) of The Public Contracts (Scotland) 
Regulations 2015; 


(b) the Supplier has, at the time of contract award, been in one of the situations 
referred to in regulation 58(1) (exclusion grounds) of The Public Contracts 
(Scotland) Regulations 2015, including as a result of the application of 
regulation 58(2) of those regulations, and should therefore have been 
excluded from the procurement procedure; or 


17.4 The Purchaser may also terminate the Contract in the event of a failure by the 
Supplier to comply in the performance of the Contract with legal obligations in the 
fields of environmental, social and employment Law. 


17.5 In addition to the Purchaser’s rights of termination under Condition 17.2, 
17.3 and 17.4, the Purchaser shall be entitled to terminate this Contract by giving to 
the Supplier not less than 30 days’ notice to that effect. 


17.6 Termination under Condition 17.2, 17.3, 17.4 or 17.5 shall not prejudice or affect any 
right of action or remedy which shall have accrued or shall thereupon accrue to the 
Purchaser and shall not affect the continued operation of Conditions 11 (Intellectual 
Property Rights), 16 (Official Secrets Acts, etc.), 22 (Audit) and 26 (Data Protection). 


18. RECOVERY OF SUMS DUE 


Wherever under the Contract any sum of money is recoverable from or payable by the 
Supplier, that sum may be deducted from any sum then due, or which at any later time may 
become due, to the Supplier under the Contract or under any other agreement or contract 
with the Purchaser or with any department, agency or authority of the Crown. 


19. | ASSIGNATION AND SUB-CONTRACTING 


19.1 The Supplier shall not without the written consent of the Purchaser assign the 
benefit or burden of the Contract or any partthereof. 


19.2 No sub-contracting by the Supplier shall in any way relieve the Supplier of any of 
the Supplier’s responsibilities under the Contract. 


19.3 Where the Supplier enters into a sub-contract must ensure that a provision is included 
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which: 

19.3.1 requires payment to be made of all sums due by the Supplier to the sub- 
contractor within a specified period not exceeding 30 days from the receipt 
of a valid invoice as defined by the sub-contract requirements and provides 
that, where the Purchaser has made payment to the Supplier in respect of 
Contract and the sub- contractor’s invoice relates to the Contract then, to 
that extent, the invoice must be treated as valid and, provided the Supplier 
is not exercising a right of retention or set-off in respect of a breachof 
contract by the sub-contractor or in respect of a sum otherwise due by the 
sub-contractor to the Supplier, payment must be made to the sub- 
contractor without deduction; 


19.3.2 notifies the sub-contractor that the sub-contract forms part of a larger contract 
for the benefit of the Purchaser and that should the sub- contractor have 
any difficulty in securing the timely payment of an invoice, that matter may 
be referred by the sub-contractor to the Purchaser; and 


19.3.3 in the same terms as that set out in this Condition 19.3 (including for the 
avoidance of doubt this Condition 19.3.3) subject only to modification to 
refer to the correct designation of the equivalent party as the Supplier and 
sub-contractor as the case may be. 


19.4 The Supplier shall also include in every sub-contract: 


19.4.1 aright for the Supplier to terminate that sub-contract if the relevant sub- 
contractor fails to comply in the performance of its contract with legal 
obligations in the fields of environmental, social or employment Lawor if any 
of the termination events (involving substantial modification of the Contract, 
contract award despite the existence of exclusion grounds) specified in 
Condition 17.3 occur; and 


19.4.2 a requirement that the sub-contractor includes a provision having the same 
effect as 19.4.1 above in any sub-contract which it awards. 


In this Condition 19.4, ‘sub-contract’ means a contract between two or more suppliers, at 
any stage of remoteness from the Purchaser in a sub-contracting chain, made wholly or 
substantially for the purpose of performing (or contributing to the performance of) the 
whole or any part of this Contract. 


20. NOTICES 


Any notice given under or pursuant to the Contract may be sent by hand or by post or by 
registered post or by the recorded delivery service or transmitted by telex, telemessage, 
facsimile transmission or other means of telecommunication resulting in the receipt of a 
written communication in permanent form and if so sent or transmitted to the address of the 
party shown on the Purchase Order, or to such other address as the party may by notice to 
the other have substituted therefor, shall be deemed effectively given on the day when in the 
ordinary course of the means of transmission it would first be received by the addressee in 
normal business hours. 


21. © COMPLIANCE WITH THE LAW ETC. 


In supplying the Goods and otherwise when performing the Contract, the Supplier must 
comply in all respects with: 
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22. 


22.1 


22.2 


23. 


23.1 


23.2 


23.3 


24. 


21.1 all applicable Law; 
21.2 any applicable requirements of regulatory bodies; and 


21.3 Good Industry Practice. 


AUDIT 


The Supplier shall keep and maintain until 5 years after the Contract has been 
completed records to the satisfaction of the Purchaser of all expenditures which are 
reimbursable by the Purchaser and of the hours worked and costs incurred in 
connection with any employees of the Supplier paid for by the Purchaser on a time 
charge basis. The Supplier shall on request afford the Purchaser or the Purchasers 
representatives such access to those records as may be required by the Purchaser in 
connection with the Contract. 


The provisions of this Condition 22 shall apply during the continuance of this Contract 
and after its termination howsoever arising. 


DISPUTE RESOLUTION 


The parties must attempt in good faith to resolve any dispute between them arising 
out of or in connection with the Contract. 


Any dispute or difference arising out of or in connection with the Contract, including 
any question regarding its existence, validity or termination which cannotbe resolved 
in good faith, shall be determined by the appointmentofa single arbitrator to be 
agreed between the parties, and failing agreement within 14 days after either party 
has given to the other a written request to concur in the appointment of an arbitrator, 
by an arbitrator to be appointed by the Scottish Arbitration Centre on the written 
application of either party. The seat of the arbitration shall be in Scotland. The 
language used in the arbitral proceedings shall be in English. 


Any arbitration under 23.2 is subject to the Arbitration (Scotland) Act 2010. 


HEADINGS 


The headings to Conditions shall not affect their interpretation. 


25. 


GOVERNING LAW 


These Conditions shall be governed by and construed in accordance with Scots Law and the 
Supplier hereby irrevocably submits to the jurisdiction of the Scottish courts. The submission 
to such jurisdiction shall not (and shall not be construed so as to) limit the right of the 
Purchaser to take proceedings against the Supplier in any other court of competent 
jurisdiction, nor shall the taking of proceedings in any one or more jurisdictions preclude the 
taking of proceedings in any other jurisdiction, whether concurrently or not. 


26. 


26.1 


DATA PROTECTION 


The Supplier acknowledges that any Personal Data described in the scope of the 
Schedule Part 1 (Data Protection) may be Processed in connection with the Contract. 
For the purposes of any such Processing, Parties agree that the Supplier acts as the 
Data Processor and the Purchaser acts as the Data Controller. 
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26.2 


26.3 


26.4 


26.5 


26.6 


Both Parties agree to negotiate in good faith any such amendments to this Contract 
that may be required to ensure that both Parties meet all their obligations under Data 
Protection Laws. The provisions of this Condition 26 are without prejudice to any 
obligations and duties imposed directly onthe Supplier under the Data Protection 
Laws and the Supplier hereby agrees to comply with those obligations and duties. 


The Supplier will, in conjunction with the Purchaser and in its own right and in respect 
of the Contract, make all necessary preparations to ensure it will be compliant with the 
Data Protection Laws. 


The Supplier will provide the Purchaser with the contact details of its data 
protection officer or other designated individual with responsibility for data 
protection and privacy to act as the point of contact for the purpose of observing its 
obligations under the Data Protection Laws. 


The Supplier must: 


26.5.1 process Personal Data only as necessary in accordance with obligations 
under the Contract and any written instructions given by the Purchaser (which 
may be specific or of a general nature), including with regard to transfers of 
Personal Data to a Third Country other than within the European Economic 
Area unless required to do so by European Union or domestic Lawor 
Regulatory Body to which the Supplier is subject; in which case the Supplier 
must, unless prohibited by that Law, inform the Purchaser of that legal 
requirement before processing the Personal Data only to the extent, and in 
such manner as is necessary for the performance of the Supplier’s obligations 
under this Contract or as is required by the Law; 


26.5.2 subject to Condition 26.5.1 only process or otherwise transfer any Personal 
Data in or to a Third Country other than within the European Economic 
Area with the Purchaser’s prior written consent; 


26.5.3 take all reasonable steps to ensure the reliability and integrity of any Supplier 
Representatives who have access to the Personal Data and ensure that the 
Supplier Representatives: 


(a) are aware of and comply with the Supplier’s duties underthis 
Condition; 

(b) are subject to appropriate confidentiality undertakings with the 
Supplier or the relevant Sub-contractor; 

(c) are informed of the confidential nature of the Personal Data and do 
not publish, disclose or divulge any of the Personal Data to any third 
party unless directed in writing to do so by the Purchaser or as 
otherwise permitted by this Contract; and 

(d) have undergone adequate training in the use, care, protection and 
handling of Personal Data. 


26.5.4 implement appropriate technical and organisational measures including those 
in accordance with Article 32 of the UK GDPR to protect Personal Data 
against unauthorised or unlawful Processing and against accidental loss, 
destruction, damage, alteration or disclosure, such measures being 
appropriate to the harm which might result from any unauthorised or unlawful 
Processing accidental loss, destruction or damage to the Personal Data and 
having regard to the nature of the Personal Data which is to be protected. 


The Supplier shall not engage a sub-contractor to carry out Processingin connection 
with the Services without prior specific or general written authorisation from the 
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Purchaser. In the case of general written authorisation, the Supplier must inform the 
Purchaser of any intended changes concerning the addition or replacement of any 
other sub-contractor and give the Purchaser an opportunity to object to such changes. 


26.7 If the Supplier engages a sub-contractor for carrying out Processing activities on 
behalf of the Purchaser, the Supplier must ensure that same data protection 
obligations as set out in this Contract are imposed on the sub- contractor by way of a 
written and legally binding contract, in particular providing sufficient guarantees to 
implement appropriate technical and organisational measures. The Supplier shall 
remain fully liable to the Purchaser for the performance of the sub-contractor’s 
performance of the obligations. 


26.8 The Supplier must provide to the Purchaser reasonable assistance including by such 
technical and organisational measures as may be appropriate in complying with Articles 12-23 
of the GDPR. 


26.9 The Supplier must notify the Purchaser if it: 


(a) receives a Data Subject Access Request (or purported Data Subject Access 
Request); 


(b) receives a request to rectify, block or erase any Personal Data; 


(C) receives any other request, complaint or communication relating to either Party's 
obligations under the Data Protection Laws; 


(d) receives any communication from the Information Commissioner or any other 
regulatory authority in connection with Personal Data processed under this Contract; 
or 

(e) receives a request from any third Party for disclosure of Personal Data where 
compliance with such request is required or purported to be required by Lawor 
regulatory order; 


and such notification must take place as soon as is possible but in any event within 3 
business days of receipt of the requestor any other period as agreed in writing with 
the Purchaser from time to time. 


26.10 Taking into account the nature of the Processing and the information available, the 
Supplier must assist the Purchaser in complying with the Purchaser’s obligations 
concerning the security of Personal Data, reporting requirements for data breaches, 
data protection impact assessments and prior consultations in accordance with 
Articles 32 to 36 of the UK GDPR. These obligations include: 


(a) ensuring an appropriate level of protection through technical and 
organisational measures that take into account the circumstances and 
purposes of the processing as well as the projected probability and severity of 
a possible infringement of the Lawas a result of security vulnerabilities and 
that enable an immediate detection of relevant infringement events. 


(b) notifying a Personal Data breach to the Purchaser without undue delay and in 
any event no later than 24 hours after becoming aware of a Personal Data 


breach; 

(c) assisting the Purchaser with communication of a Personal Data breach to a 
Data Subject; 

(d) supporting the Purchaser with preparation of a data protection impact 
assessment; 


(e) supporting the Purchaser with regard to prior consultation of the 
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Information Commissioner. 


26.11 At the expiry or termination of the Contract the Supplier must, on written instruction 
of the Purchaser, delete or return to the Purchaser all Personal Data and delete 
existing copies unless EU or domestic Lawrequires storage of the Personal Data. 


26.12 The Supplier must: 


(a) provide such information as is necessary to enable the Purchaser to satisfy 
itself of the Supplier’s compliance with this Condition 26; 


(b) allow the Purchaser, its employees, auditors, authorised agents or advisers 
reasonable access to any relevant premises, during normal business hours, to 
inspect the procedures, measures and records referred to in this Condition 26 
and contribute as is reasonable to those audits and inspections; 


(c) informthe Purchaser if, in its opinion, an instruction from the Purchaser 
infringes any obligation under the Data Protection Laws. 


26.13 The Supplier must maintain written records of all Processing activities carried out in 
performance of the Contract or otherwise on behalf of the Purchaser. 
Such records must contain the information set out in Article 30(2) of the UK GDPR 
and may be kept in electronic form. 


26.14 If requested, the Supplier must make such records referred to Condition 26.13 
available to the Information Commissioner on request and co-operate with the 
Information Commissioner in the performance of its tasks. 


26.15 Parties acknowedge that the inspecting party will use reasonable endeavours to 
carry out any audit or inspection under Condition 26.14 with minimum disruption to 
the Supplier’s day to day business. 
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SUPPLEMENTARY NOTICE 


1. PROTECTING THE ENVIRONMENT 


Suppliers to the National Records of Scotland are requested to satisfy themselves 
that no product will be supplied or used in the Supply of Goods to the Purchaser 
whichwill endanger the health of the consumers or others, will cause significant 
damage to the environment during manufacture, use, or disposal, which consumes 
a disproportionate amount of energy during manufacture, use, or disposal, which 
causes unnecessary waste because of over-packaging or because of an unusually 
short shelf life, or which contains materials derived from threatened species or 
threatened environments. 


2. LATE PAYMENT OF INVOICES 


Suppliers to the National Records of Scotland are requested to address complaints 
regarding late payment of invoices to, in the first instance, the addressee of the 
invoice and, in the second instance to the Chief Purchasing/Procurement Officer 
Ladywell House, Ladywell Road, Edinburgh, EH12 7TF. This procedure is 
suggested as the best practical way of ensuring problems of late payment are 
resolved, and is not intended to interfere with Suppliers’ legal rights. 


THIS NOTICE DOES NOT FORM PART OF THE CONDITIONS OF CONTRACT 


SCHEDULES 


The following two schedules may be required to form part of the contract. 


PART 1 DATA PROTECTION 
PART 2 CYBER SECURITY REQUIREMENTS 


Where either, or both, of these schedules are required it will be clearly stated by the 
Purchaser in the tender documents: 
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This is the Schedule referred to in the foregoing Conditions of Contract for the Purchase 
of Goods between [PURCHASER NAME] and 


SCHEDULE 
PART 1 
DATA PROTECTION 
Data Processing provision as required by Article 28(3) UK GDPR. 


This Schedule Part 1 includes certain details of the Processing of Personal Data in connection 
with the supply of Goods under this Contract: 


il 
W 


The obligations and rights of the Purchaser as the Data Controller are set out in Condition 26 of 
the Contract. 
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This is the Schedule referred to in the foregoing Conditions of Contract for the Purchase 
of Goods between [PURCHASER NAME] and [SUPPLIER NAME] 


SCHEDULE PART 2 
CYBER SECURITY REQUIREMENTS 


Drafting notes: 
. Please note that this Schedule Part 2 including the Annex are optional. The Purchaser may choose to incorporate these in the 


Contract at its discretion. 
e Text in red requiresto be amended/updated by the Purchaser to reflect the specificcircumstances of the Contract. 





1. DEFINITIONS 
1.1. The defined terms used in this Schedule Part 2 shall have the following meanings: 


[“Cyber Implementation Plan” means the cyber implementation plan set out in Section B 
(Cyber Implementation Plan)] of the Annex to Schedule Part 2 (Cyber Security 
Requirements);] 


included. Otherwise it may be removed. 





“Cyber Security Incident” means any thing, event, act or omission which gives, or may 
give, rise to: 


(i) unauthorised access to any information system, data or electronic communications 
network (including breach of an applicable security policy); 

(ii) reduced integrity of an information system, data or electronic communications 
network; 

(iii) unauthorised use of any information system or electronic communications network 
for the processing (including storing) of data; 

(iv) disruption or change of the operation (including, but not limited to, takeover of 
control, malicious disruption and/or denial of service) of an information system or electronic 
communications network; 

(v) unauthorised changes to firmware, software or hardware; 

(vi) unauthorised destruction, damage, deletion or alteration of data residing in an 
information system or electronic communications network; 

(vii) | removal or limiting the availability of, or possibility to use, data residing in an 
information system or electronic communications network; 

(viii) the appropriation, publication, dissemination or any other use of data by persons 
unauthorised to do so; or 

(ix) a breach of the Computer Misuse Act 1990, the Network and Information Systems 
Regulations 2018, the Data Protection Laws, the Privacy and Electronic Communications 
(EC Directive) Regulations 2003, the Communications Act 2003, the Official Secrets Act 
1911 to 1989, or any other applicable legal requirements in connection with cybersecurity 
and/or privacy 


in connection with the Goods and/or the Contract; 


Drafting note: Please note that the Privacy and Electronic Communications (EC Directive) Regulations 2003 are planned to be 
replaced with new legislation in the future. 





“Cyber Security Requirements” means the Purchaser's requirements in connection with cyber 
security as set out in Section A (Cyber Security Requirements [and Section B ( Cyber 
Implementation Plan)| of the Annex to this Schedule Part 2 (Cyber Security Requirements), [the 
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Purchase Order, paragraph[ ] ofthe tender documentation and [ ] of the Contract] ; 


Drafting note: 
° The Purchaser should amendthe above definition asappropriate. 
o Reference to Cyber Implementation Plan may not be required where a Cyber Implementation Plan will not be 


incorporated intothe contract. 

o If the Purchase Order, the Contract or tender documentation include any additional requirements relevant to cyber 
security, the Purchaser may wish to reference these here. The Purchaser may wish to refer to specific paragraphs 
within the Purchase Order and/or the tender documentation and/or other part of the Contract. 





2. CYBER SECURITY REQUIREMENTS 
2.1 The Supplier shall comply with the Cyber Security Requirements and shall implement and 
maintain all security measures: 
(a) as may be required under applicable laws (including but not limited to the 
Network and Information Systems Regulations 2018); 


(b) to enable it to discharge its obligations under this Schedule Part 2 (Cyber 
Security Requirements); and 


(c) to ensure there are no Cyber Security Incidents 


in all cases to the Purchaser’s reasonable satisfaction and in accordance with Good Industry 
Practice. 


2.2 The Supplier shall notify the Purchaser immediately it knows or believes that a Cyber Security 
Incident has or may have taken place and shall provide full details of the incident and any 
mitigation measures already taken and intended to be taken by it and (where applicable) any 
mitigation measures recommended by it to be taken by the Purchaser. 


2.3 If the Supplier fails to comply with the provisions of paragraphs 2.1 and/or 2.2, the Purchaser 
may take any action it considers appropriate or necessary (and the Supplier shall comply with 
the Purchaser’s requests in this respect). 
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ANNEX 


Drafting note: This Annex isnotrequired where Schedule Part 2 isnotincorporated into the Contract, atthe Purchaser's sole option. 





The cyber security requirements applicable to the Contract are set out in this Annex to Schedule 
Part 2. Section A (Cyber Security Requirements) includes the Purchaser’s requirements in 
connection with cyber security [and Section B (Cyber Implementation Plan) sets out further details 
on how the Supplier will meet such requirements]. 


Drafting note: The Purchaser should retainthe reference to Section B above if: 

e the Scottish Cyber Assessment Service (SCAS) tool hasbeen used in connection withthe contract; and 

e the Supplier andthe Purchaser have agreed a Cyber Implementation Plan in conjunction with the SAQ re port generated by the 
SCAS tool 





Section A: Cyber Security Requirements 


Overview of requirements: 


< [Low 
[Additional questions for [Cloud security] 
management of specific [Personal data security] 
cyber risks covering:] [Governance] 
[Etc.] 
[Certification requested for [Cyber Essentials or equivalent] 
assurance purposes] [Cyber Essentials Plus or equivalent] 
[IASME Gold or equivalent] 
IS027001 or equivalent 


e [Insert details of any supporting evidence 
required] required 
management approach] e [Cyber Implementation Plans accepted 
Drafting note: If the SCAS tool isused, insert information inthe above table that summarisesthe Purchaser’s cyber security 
requirements. Cyber security requirements set out in this Schedule Part 2 and the Annex should not deviate from the requirements 


set outin any part of the tender documentation. An exampleisprovided above. The Purchaser should checkand amendfields 
and entriesto fit itscontract. 





The Supplier shall meet the following requirements: 


Drafting note: If the SCAS tool isused, the Purchaser's requirementsfrom SCAS require to be incorporated into the contract. 

Two optionsto achieve thisinclude the following: 

. OPTION 1: Either cut and paste or append the full “SAQ Responses’ section of the Suppliers SAQ Report, which sets out all 
questions asked of bidding suppliersin the SCAS SAQ (i.e. the Purchaser's requirements), and the Supplier’s responses. 
Please also include details of subsequent clarifications with the Supplier, if applicable. 

OPTION 2: provide the following information (asset out in the table below) from the SCAS tool. 


The Purchaser should choose the option appropriate to the contract, Option 1 being preferable from the pointof view of clarity. In 
case of Option 2, the Purchaser should retain records of its requirementsand the Suppliersresponses. The Purchaser should 
also retain all metadata/ otherinformation (such ase-mail alerts) generated by SCAS relating to completion of SAQsby it and the 
Supplier. 
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The cyber security e [Insert reference number for contract] 
requirements for the 

Contract, and the 

Supplier’s responses, are 

set out in the Scottish 

Cyber Assessment Service 

under the following 

reference number: 


Time that the Supplier e [Insert the time and date at which the Supplier 
submitted its responses to submitted its response to the SAQ via SCAS] 
the above cyber security 


requirements via SCAS: 


Details of any subsequent |e [Insert details of any subsequent clarifications] 
clarifications: 


Drafting note: If SCAS is NOT used, the Purchaser should insert applicable cyber security requirementshere. Thismay include 
extracting / making reference to relevantpartsof the Purchase Order and/or other parts of the Contract and/or the tender 
documentation. Cyber security requirements set out in this Schedule Part 2 and the Annex should not deviate from the 
requirementsset out in any part of the tender documentation. 





[Section B: Cyber Implementation Plan 


Drafting note: If SCAS is used, and a Cyber Implementation Plan hasbeen submitted by the Supplier and agreed by the 
Purchaser, the Purchaser should include thissection B and the text below (if not, thissection B may be deleted). Ensure that the 
date or contract phase isamended to align with the requirements communicatedin the Purchase Order and/or any other part of 
the Contract and/or the tender documentation andthe SCAS tool. 


The Purchaser should insert below the frequency of review of the Cyber Implementation Plan with the Supplier. Thisshould match 
any frequency indicated inthe Purchase Order and/or elsewhere inthe Contract and/or the tender documentation . 
The template Cyber Implementation Plan may be found from the following address: https://www. gov. scot/publications/cyber- 


resilience-supply-chain-guidance 





The Supplier shall followthe agreed Cyber Implementation Plan to meet the requirements of 
Section A by no later than the date(s) set out in the Cyber Implementation Plan. The parties shall 
review the Supplier’s progress on the Cyber Implementation Plan regularly every [4 weeks]. If the 
Supplier fails to meet the commitments set out in the Cyber Implementation Plan, this shall be 
considered to be a material breach of the Contract for the purposes of Condition 17.2 
(Termination). 


Drafting note: Insert orappend the agreed Cyber Implementation Plan below. Thetemplate Cyber Implementation Plan may be 


found from the following address: https://www. gov. scot/publications/cyber-resilience-supply-chain-guidance 
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